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n. CLAIM AMENDMENTS 

1. (Original) A method (400) for processing location information, which is related to a 
certain mobile station in a cellular network, the method comprising the step of: 

- a first network element, which is connected to the cellular network, receiving 
(401) a location information request (201) relating to the mobile station from a 
second network element, which is connected to a packet data network, 

- requesting (404) from a third network element, which is connected to the 
packet data network, a security document relating to the second network 
element, 

- initiating the establishment (406) of at least one security association, which 
security association specifies at least data origin authentication and points from 
the second network element to the first network element and which 
establishment involves use of information comprised in the security document, 

- after successful establishment of said security association, authenticating (408) the 

data origin of the location service request, and 

-if the data origin of the location service request is authenticated successfully, 
initiating (410) a location procedure relating to the mobile station in the cellular 
network. 

2. (Original) A method according to claim 1, wherein the security document relating 
to the second network element is a public key certificate, which comprises an identifier 
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Specifying the second network element and a public key of the second network element 
and which is cryptographically signed by the third network element. 

3. (Original) A method according to claim 1, further comprising the step of: 

-requesting from the third network element a second security document relating to 
the first network element. 

4. (Original) A method according to claim 3, wherein the security document 
comprises a first key, which is encrypted using a second key shared between the first 
network element and the third network element, and the second security document 
comprises the first key, which is encrypted using a third key shared between the second 
network element and the third network element. 

5. (Original) A method according to claim 3, further comprising the step of: 

-initiating the establishment of a second security association from the first network 
element to the second network element using at least information comprised in 
the second security document. 

6. (Original) A method according to claim 5, wherein the security association is a 
set of Internet Security Associations pointing from the second network element to the 
first network element and the second security association is a second set of Internet 
Security Associations pointing from the first network element to the second network 
element. 
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7. (Original) A method according to claim 5, wherein the second security 
association specifies at least data encryption. 

8. (Original) A method according to claim 1, wherein the security association is a 
set of Internet Security Associations pointing from the second network element to the 
first network element. 

9. (Original) A method according to claim 1, further comprising the steps of: 

-a third network element, which is connected to the packet data network, producing 
(404) said security document, 

-establishing (406) at least one security association, which specifies at least data 
origin authentication and which points from the second network element to the 
first network element, using at least information comprised in the security 
document, and 

-after the establishment of said security association, authenticating (408) the data 
origin of the location service request, and 

-carrying out (701) a location procedure relating to the mobile station in the cellular 
network. 

10. (Original) A method according to claim 9, further comprising the step of: 

-transmitting (707, 713) location information relating to the mobile station to the 
second network element. 
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11. (Original) A method according to claim 10, wherein the location information 
relating to the mobile station is transmitted to the second network element from the 
first network element. 

12. (Original) A method according to claim 11, further comprising the steps of: 

-the third network element producing a second security document relating to the 
first network element, and 

-establishing a second security association, which specifies at least data encryption 
and points from the first network element to the second network element, using 
at least the information specified in the second security document. 

13. (Original) A method according to claim 10, further comprising the step of: 

- before transmitting the location information to the second network element, 
establishing (708) a third security association, which specifies at least data origin 
authentication and points from the second network element to a packet data 
device, which is either connected to the mobile station or is an integral part of 
the mobile station. 

14. (Original) A method according to claim 10, wherein the location information 
relating to the mobile station is transmitted from a device, which is either connected to 
the mobile station or is an integral part of the mobile station. 

15. (Original) A method according to claim 14, further comprising the step of: 
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- before transmitting the location information to the second network element, 

establishing (708) a third security association, which specifies at least data origin 
authentication and points from the second network element to a packet data 
device, which is either connected to the mobile station or an integral part of the 
mobile station. 

16. (Original) A method according to claim 15, further comprising the step of: 

- before transmission of location information, establishing (710) a fourth security 

association, which specifies at least data encryption and which points to the 
second network element from said packet data device. 

17. (Original) A method according to claim 14, further comprising the steps of: 

- the mobile station receiving (702) a notification relating to the location procedure 

relating to the mobile station, and 

- the mobile station informing (703) said packet data device about the notification. 



18. (Original) A method according to claim 1, wherein the first network element is a 
network element of a GPRS network. 



19. (Original) A method according to claim 18, wherein the first network element is a 
Gateway Mobile Location Center. 
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20. (Original) A method according to claim 1, wherein the first network element is a 
network element of a UMTS network. 

21. (Original) A network element (900) of a cellular network, the network element 
comprising 

- means (910) for receiving from a packet data network a location information 

request relating to a certain mobile station, 

- means (920) for initiating a location procedure in the cellular network, 

- means (930) for establishing security associations pointing to the network element 

from a network element of the packet data network, 

- means (931) for performing security functions as specified by the security 
associations on data it receives from the packet data network, 

- means (932) which are arranged to determine, if there is an existing security 

association pointing to the network element from a sender of a location 
information request, and 

- means (933) for initiating security association establishment, which are arranged 

to establish a security association if there does not exist a security association, 
which points towards the network element from the sender of a location 
information request. 

22. (Original) A network element according to claim 21, further comprising 
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- means (940) for receiving from a device reachable via the cellular network a 

request about a security association, which points to the network element from a 
certain network element of the packet data network, 

- means (932) for determining whether a requested security association exists, and 

- means (940) for transmitting information about the requested security association 

to the device. 

23. (Original) A network element according to claim 21, further comprising 

- means (943) for receiving a request to produce security documents relating to the 

device and to the sender of a location information request, and 

- means (944) for producing a first security document relating to the device and a 

second security document relating to the sender of the location information 
request. 

24. (Original) A network element according to claim 21, wherein it is a network 
element of a GPRS network. 

25. (Original) A network element according to claim 24, wherein it is a Gateway 
Mobile Location Center. 

26. (Original) A network element according to claim 21, wherein it is a network 
element of a UMTS network. 
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27. (Currently Amended) A packet data device (950) being an integral part of a 
mobile station or being attachable to a mobile station, comprising a processor, the 
processor being configured to: 



about a sender of a location information request from a mobile station; and 

mcons (070) for c xchangemg with a network element connected to a cellular 
network information about a security association, which points to the network 
element from the sender of the location information request. 

28. (Currently Amended) A device according to claim 27, wherein the processor is 
further compr i s i ng means (9 8 0) fo rc onfiqured to establishmg a second security 
association, which points to the device from the sender of the location information 
request and specifies at least data origin authentication. 

29. (Currently Amended) A device according to claim 28, wherein the processor is 
further compr i s i ng means (9 8 0) for c onfigured to requesttf(§ a network element of the 
cellular network to produce security documents relating to the device and to the sender 
of the information request for the establishment of the second security association. 

30. (Currently Amended) A device according to claim 27, wherein the processor is 
further comprising means (990) fo rc onfiqured to transmitting to the mobile station a 
permission to send location information to the sender of the location information 
request, which means are arranged to transmit the permission when there is said 
security association. 




-receiveif^g information about a location information request and 
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31. (Currently Amended) A device according to claim 27, further comprising mconsa 
receiver of a positioning system for locotinq itself . 

32. (Currently Amended) A device according to claim 31, wherein the receiver is 
compr i sing a Global Positioning System receiver. 

33. (Currently Amended) A mobile station (901), comprising a processor, the 
processor being configured to: 

mcons for receivetnf a notification from a cellular network about the location 
information request, 

moons for respondm§ to the cellular network with a notification response, and 

means for notifytft§ a packet data device, which is either an integral part of the 
mobile station or attached to the mobile station, about the location information 
request. 

34. (Currently Amended) A mobile station according to claim 33, wherein the 
processor is configured to initiate means for responding to the cellular network-af=e 
arranged to be in i tiated by a permission sent by the packet data device. 
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